testing1345 (PyPI): malicious package installs RAT via setup.py remote script download
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
The PyPI package testing1345 (version 0.1.0) was identified as malware and published to the GitHub Advisory Database on 2026-11-13 (GHSA-w462-j2j5-xmp7). The package overrides the install command in setup.py so that installing it downloads and executes a script from a remote server. The server serves varying payloads, some benign and some containing next-stage installation, with the final payload being a remote access trojan (RAT). Anyone who pip-installed testing1345 0.1.0 may have a RAT running on their machine. There is no patched version; the package is malware and should be removed. Attribution/analysis credited to kam193 and OpenSSF malicious-packages, with sandbox and VirusTotal references available.
What to do
- Check whether testing1345 (0.1.0) was installed in any environment; if so, isolate and rebuild the host from trusted images
- Treat any machine where the package was installed as compromised: rotate credentials, tokens, and SSH keys accessible from it
- Audit pip install logs and CI pipelines for the package name and for setup.py executing remote downloads
- Block the package and associated indicators in artifact registries and proxy caches
- Hunt for RAT-style C2 traffic on potentially affected hosts
Sources
All live incidents on Threat Watch
